Commit 809c22cd420 for php

commit 809c22cd420c760e51467c315cd0641da7f56387
Merge: fd4bbc0c7a2 5df5e4a20ec
Author: Jorg Sowa <jorg.sowa@gmail.com>
Date:   Mon Nov 9 23:06:14 2026 +0100

    Merge branch 'PHP-8.5' into PHP-8.6

    # Conflicts:
    #       Zend/zend_execute.c

diff --cc NEWS
index 94a4cb4de83,c0da02811a2..09876838bc3
--- a/NEWS
+++ b/NEWS
@@@ -16,13 -16,11 +16,16 @@@ PH
      cached). (lazerg)
    . Fixed bug GH-25265 (Misaligned read for virtual internal props in
      hooked subclass). (Lazizbek Ergashev)
 +  . Fixed bug GH-25314 (Assertion in ZEND_DO_FCALL: reference returned by
 +    &__get() reaches property hook TMP result). (ndossche)
 +  . Fix support for never-returning functions in PFAs. (ndossche)
 +  . Fixed array_map() optimization not resolving the function name of an FCC.
 +    (ChrisAbner)
    . Fixed bug GH-25302 (Use-after-free in zend_compile_const_decl() with
      OPcache during concurrent compilation). (Nicolas Grekas)
+   . Fixed use-after-free when the error handler releases a string while an
+     "Illegal string offset" warning is raised for its offset in a read, ?? or
+     nested isset()/empty(). (Jorg Sowa)

  - Curl:
    . Fixed curl_reset() retaining CURLOPT_PRIVATE after reset. (lacatoire)
@@@ -54,13 -49,10 +57,16 @@@
      (lazerg, mlenarciak)
    . Fixed JIT ignoring leading-numeric string offsets in isset(), empty() and
      ??. (Jorg Sowa)
+   . Fixed use-after-free in JIT when the error handler releases a string while
+     an "Undefined variable" warning is raised for its offset in ?? or nested
+     isset()/empty(). (Jorg Sowa)

 +- OpenSSL:
 +  . Fixed bug GH-25172 (TLS session reuse shares request-lifetime callback
 +    structures with persistent streams). (cxxz16, David Carlier)
 +  . Fixed an exception thrown by the session_get_cb stream context callback
 +    being replaced with a TypeError. (Ilia Alshanetsky)
 +
  - PDO_Firebird:
    . Fixed stack buffer overflow with long connection user names, passwords,
      charsets, or roles. (Ilia Alshanetsky)
diff --cc Zend/zend_execute.c
index e929bc41a03,5996905fdb1..8cc7cd7ca49
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@@ -3116,7 -3084,17 +3116,17 @@@ try_string_offset
  					if (IS_LONG == is_numeric_string_ex(Z_STRVAL_P(dim), Z_STRLEN_P(dim), &offset,
  							NULL, /* allow errors */ true, NULL, &trailing_data)) {
  						if (UNEXPECTED(trailing_data)) {
+ 							/* The string may be destroyed while throwing the warning.
+ 							 * Temporarily increase the refcount to detect this situation. */
+ 							if (!(GC_FLAGS(str) & IS_STR_INTERNED)) {
+ 								GC_ADDREF(str);
+ 							}
 -							zend_error(E_WARNING, "Illegal string offset \"%s\"", Z_STRVAL_P(dim));
 +							zend_error(E_WARNING, "Illegal string offset \"%pS\"", Z_STR_P(dim));
+ 							if (!(GC_FLAGS(str) & IS_STR_INTERNED) && UNEXPECTED(GC_DELREF(str) == 0)) {
+ 								zend_string_efree(str);
+ 								ZVAL_NULL(result);
+ 								return;
+ 							}
  						}
  						goto out;
  					}